How your data is protected, and where the limits are.
Krewbill is in early development. This page separates what is in place from what is not, so nothing here is promised that is not true.
In place today
What is protected now.
- Sign-in is handled by Supabase Authentication, with email and password or Google. Sign-in and password reset emails are sent from our own domain.
- Every table in the database has row-level security. Each person can read only the workspaces they belong to, and only the spaces they were given, with the role they were given.
- Assistants can never approve notes. Suggestions from an assistant are saved as pending by the database itself, and are never returned to an assistant as memory until a person approves them. The server cannot approve, edit or archive a note either.
- Connection keys are limited to the spaces you choose, can be read only or read and suggest, stored only as one-way hashes, shown once and revocable immediately. When a person is removed from a workspace, the keys they made are revoked too.
- The connection endpoint refuses requests without a valid key, limits request size, and rate limits both keys and failed attempts.
- An audit log records who did what and when, without storing note content.
- You can export a space as Markdown or JSON, delete a space or workspace, and delete your account.
- The site runs on Vercel, with Supabase for the database and sign-in and Resend for email. All traffic uses HTTPS, and the site sets basic security headers.
- Automated tests check that people in one workspace cannot read another's data, that roles are enforced, and that activation events never contain content.
Limits today
What is not done yet.
- Assistants connect with a key in the connection address rather than by signing in as a person. Anyone who holds the address can read the approved notes of its spaces, and the address can appear in some tools' logs. Create one key per tool, and revoke keys you no longer use.
- There is no page yet that shows the audit log or how much assistants use your spaces.
- Notes are not encrypted separately from the database's own encryption at rest.
- Please keep passwords and other secrets out of your spaces.
Where things run
Infrastructure, and what we have not done.
Found a vulnerability or have a concern? Email hello@krewbill.com with the details and we will respond.
Try it with one space.
Create an account, make a space, and tell us what you would need before using it with a real team.